Practical Library Of Threats 4 Artificial Intelligence
A threat modeling library to help you build Trustworthy AI
What is PLOT4AI?
PLOT4ai is a comprehensive threat modeling methodology designed for developers and deployers of AI systems to support the identification and mitigation of AI risks.
It includes a library of 138 AI related threats, covering a 8 domains:
- Data & Data Governance
- Privacy & Data Protection
- Bias, Fairness & Discrimination
- Safety & Environmental Impact
- Cybersecurity
- Ethics & Fundamental Rights
- Transparency & Accessibility
- Accountability & Oversight
With PLOT4AI you can:
- Perform threat modeling on AI/ML and Generative AI systems across the entire AI lifecycle, from design to deployment and monitoring
- Identify and mitigate real-world risks, from privacy breaches to model failures, systemic bias, misuse and adversarial attacks
- Implement Privacy by Design, Safety by Design, and Security by Design, aligned with the GDPR, EU AI Act, and other regulatory frameworks
- Build Trustworthy AI, ensuring your systems are not only effective, but responsible, transparent, and human-centric
The PLOT4AI threat library is available online as a digital card deck, along with an assessment tool that helps you apply the methodology directly in your projects. You can also download the full library in PDF and other formats, or even get one of the physical card decks to use in workshops and team sessions. Visit the Resources section on the website to learn more.
Whether you're a developer, researcher, risk owner, policymaker or product lead, PLOT4ai helps you bridge the gap between technical design and ethical oversight.
How it started
PLOT4AI was created by Isabel Barberá, a privacy engineer and AI advisor based in the Netherlands.
Originally published in 2022 after three years of research to support responsible AI practices, it has since evolved into a comprehensive and accessible resource for anyone building AI systems. A major update has been released in 2025, expanding the threat library and reflecting the fast-changing landscape of AI risks.
Inspired by collaborative threat modeling approaches such as LINDDUN GO, PLOT4AI has been adapted specifically for the context of AI.
How it is going
Today, PLOT4AI is actively maintained, updated, and improved by Isabel Barberá. With ongoing input from the community, PLOT4AI continues to evolve alongside emerging developments in AI.
A new expansion focused on third-party AI vendor assessment is currently in progress, we're working on translating the library and we will soon start working on example use cases.
Organizations interested in using PLOT4AI internally can request a hands-on workshop. To learn more, contact Isabel directly via LinkedIn
Why threat modeling?
"When you perform threat modeling, you begin to recognize what can go wrong in a system. It also allows you to pinpoint design and implementation issues that require mitigation, whether it is early in or throughout the lifetime of the system."
Source: Threat Modeling Manifesto
Frequently Asked Questions
Got a question? We might already have the answer
-
Under which license is the library published?
PLOT4AI by Isabel Barberá is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License
For any reuse or distribution, you must make the license terms of this work clear to others. -
What are the differences with LINDDUN?
LINDDUN is a privacy threat modeling methodology that I think can work very well with software development, but it is not adapted for AI/ML. It contains different categories and threats, but it also has a lot of similarities with PLOT4AI. In fact, PLOT4AI is inspired by LINDDUN - read the story here. I really recommend you try it!
-
Which regulations are covered within the Non-compliance category?
For the time being this category is only based on the GDPR.
-
Do I need to use all the cards during the threat modeling session?
You can first check all the cards and remove the ones that are not relevant to you; for instance some of them are related to robotics and this might not be applicable to your case.
I recommend you to go through all or most of the cards (that you selected) during the design phase of your project. This should not take more than 2 sessions. And this is also a good exercise for start-ups that do not have a mature quality process implemented yet!
You could also decide to remove the cards related to the category security and plan a separate session for that. The security threats of AI/ML are mostly very technical and that is why it's important that the right stakeholders are present during this session.
A similar situation occurs with the category Ethics & Human Rights; answering these cards could take longer than usual due to the nature of the subject, so a dedicated session might work better. -
Where does all the information in the library come from?
The library is the result of months of research work analyzing different sources of information, like whitepapers, guidelines, best practices, articles, blogs, and regulations like the new EU proposal for AI. All these sources are directly mentioned in the cards or in the reference list on this website.
The library also contains content created by me. My experience in the field has played an important role here; otherwise I could have never been able to create PLOT4AI by myself ;-) -
Why is PLOT4AI free? Do you have a commercial purpose?
The reason I've dedicated so many hours to this project is because I truly believe in it, and I would love nothing more than to see it adopted widely around the world. If this tool helps create more responsible AI products, that will be my greatest reward.
In the future, I may offer paid workshops to teach others how to use PLOT4AI, that's the only commercial aspect I currently foresee. But this is something anyone can do, and I sincerely hope many of you will! I would love to see people teaching and sharing PLOT4AI.
What's next?
With the major 2025 update of PLOT4AI now released, the work doesn't stop here, there are exciting things ahead on the roadmap!
Vendor Risk Assessment Expansion
We're currently developing a new version of PLOT4AI focused on assessing the risks of third-party AI vendors.
This will include a structured methodology and an online assessment tool to help organizations evaluate the trustworthiness and risk exposure of external AI systems.
Stay Tuned!
Translations
We want to translate PLOT4AI into other languages. Dutch and Spanish will probably be the first ones ;-)
Continued Improvements
Although PLOT4AI started as a solo project, it's grown with the input and support of the community.
Now more than ever, we want to continue improving the threat library and methodology with your feedback. The long-term goal is to make PLOT4AI a truly community-driven project, and we'd love for you to be part of it.
Interested in supporting this open source project? See How to contribute for more information
Contact
If you want to get involved, please have a look at the contribution page, or go directly to GitHub